CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where...7.1 High
- shrec ultrafastsecp256k1UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding5.9 Medium
- apache software foundation plc4xApache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade9.2 Critical
- lantronix g520 seriesLantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature7.7 High
- anjvision yssd-rtmp-h5Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H58.7 High
- jpadilla pyjwtPyJWT accepts public JWK containers as HMAC secrets7.4 High
- jpadilla pyjwtPyJWT BOM Bypass7.4 High
- jpadilla pyjwtPyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard7.4 High
- jpadilla pyjwtPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard9.1 Critical
- jpadilla pyjwtPyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation7.4 High
- authlibAuthlib library contains a signature‑verification bypass vulnerability9.8 Critical
- wolfsslSignature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY2.3 Low
- zammadZammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail5.3 Medium
- zammadZammad: S/MIME signature verification allows forged sender impersonation7.1 High
- zammadZammad: PGP signature spoofing via unvalidated verification return7.1 High
- ironmace ironshieldIRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client...5.1 Medium
- minioMinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears...7.1 High
- python-social-auth social-coresocial-auth-core: VK App backend accepts unsigned callback data when auth_key is missing7.4 High
- dashbit nimble ztaImproper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy9.3 Critical
- foxit pdf editor, pdf reader +1 moreSecurity vulnerability: Foxit PDF Editor/Reader Fails to Detect Modifications to Signed Documents Displaying Newly Added Content5.3 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities7.4 High
- notepad-plus-plusNotepad++: Authenticode verification bypass allows modified updater execution7.3 High
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled6.8 Medium
- red hat openshift container platform 4, openshift container platform 4.18, openshift container platform 5 +2 moreOpenshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed7.4 High
- red hat openshift data foundation 4Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header7.1 High
- themehigh payment gateway of stripe for woocommercePayment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint5.3 Medium
- axdsan mnemosyneMnemosyne has JWT signature verification bypass sync server that allows authentication bypass9.1 Critical
- cohesity netbackup flex osSensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell4.8 Medium
- cohesity netbackup flex osPrivilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell9.4 Critical
- midnightbsd mportmport bootstrap index fetch can continue after hash verification failure8.3 High
- libp2p js-libp2plibp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID7.5 High
- team-alembic ash authenticationToken revocation record built from unverified JWT claims in AshAuthentication6.9 Medium
- projectdiscovery nucleiNuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache7.0 High
- fermax electronica s.a.u. duox plus monitor firmware (veo wi-fi range)Improper Verification of the Firmware Signature vulnerability7.7 High
- arista networks velocloud edgeSecurity Advisory 01827.5 High
- apache software foundation syncopeApache Syncope: SRA OAuth2 JWT signature verification bypass9.1 Critical
- kimdre doco-cdDoco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration6.5 Medium
- sick ag sentio creator extension 'device manager'CVE-2026-804698.3 High
- hewlett packard enterprise hpe icewall productsHPE IceWall products, Remote Bypass of Security Restrictions8.8 High
- debian live-bootlive-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection...4.1 Medium
- krakenjs passport-saml-encryptedpassport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending9.1 Critical
- krakenjs passport-saml-encryptedpassport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification9.3 Critical
- appsup-dart joseIn the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only...9.1 Critical
- drupal saml sso - service providerSAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-1454.8 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.6 Medium
- apache impalaApache Impala: SAML authentication bypass via forged bearer token9.8 Critical
- n8nn8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open6.3 Medium
- microsoft skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 +2 more +4 moreSkype for Business Spoofing Vulnerability8.3 High
- microsoft remote desktop client for windows desktop, remote desktop client +1 moreMicrosoft Remote Desktop App for Windows Information Disclosure Vulnerability7.5 High
- commvault, commvault cloud +1 moreCommServe Privilege Escalation8.7 High
- Show moreLoading…